https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

Modelling the failure, the subsequent loss of life and how it could have been reduced Darren Lumbroso1, Mark Davison1, Richard Body1, Gregor Petkovšek1 1HR Wallingford, Howbery Park, Wallingford, Oxfordshire OX10 8BA, UK 5 Correspondence to: Darren Lumbroso ([email protected])

Abstract. In recent years the number of tailings failures has increased. On 25 January 2019, the Brumadinho in suddenly failed releasing a mudflow over 10 m deep comprising some 10 million m3 of waste which killed between 270 and 320 people. This paper details the use of an agent-based model, known as the Life Safety Model (LSM), to estimate the risk to people downstream of the Brumadinho tailings dam and to assess if the number of fatalities 10 could have been reduced if a warning had been received prior to or at time the dam failed. The LSM modelling indicates that even if a warning had been issued as the dam failed the number of fatalities could have been reduced. Agent-based modelling tools such as the LSM can help to inform and improve emergency plans for tailings dams, which will help to reduce the risk posed by them in the future.

1 Introduction

15 Tailings dams are earth embankments used to store waste materials, known as tailings, from mining operations. They can be more than 100 m high and in some cases several kilometres long (Kossoff et al., 2014). Tailings dams are often constructed from readily available materials and over their operating life they are frequently raised as the quantity of stored tailings increases (Lumbroso et al., 2019). Tailings dams are long-lived infrastructure which are often required to be in place in perpetuity (Lumbroso et al., 2019). In 20 the context of long-lived infrastructure the rate of failure of tailings dams is high, owing to inadequate design regulations, as well as less rigorous construction and supervision methods than for normal water-retaining dams, especially in low-income countries (Bowker & Chambers, 2017). There are three principal methods via which tailings dams are constructed: upstream, downstream and centreline. These are shown in figure 1. The upstream method, has the lowest initial cost, owing to the minimal amount of fill material required for the initial construction and subsequent raising which normally consists entirely 25 of the coarse fraction of the tailings (Martin & McRoberts, 1999). Martin and McRoberts describe upstream tailings dams as “unforgiving structures” with any one or combinations of improper design, construction and operation resulting in a catastrophic failure (Martin & McRoberts, 1999). In recent years the number of tailings dam failures has increased. Around half of the significant tailings dam failures in the last 70 years occurred between 1990 and 2010 (Azam & Li, 2010). In South America there are around 1,200 mines currently in

1

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

30 operation which have tailings dams and many thousands of tailings dams which have been abandoned and/or which are no longer operational (Azam & Li, 2010). In 2001 the International Commission On Large Dams (ICOLD) stated that “the mining industry has a less than perfect record when tailings dam failures are reviewed" (ICOLD, 2001). Although this statement was made almost 20 years ago the probability of a tailings dam failing is still high in the context of long-lived infrastructure (Bowker & Chambers, 2017; Lyu et al., 2019). In Brazil there have been 12 major tailings dam failures since 1986, which 35 have resulted in over 1,000 deaths and adversely affected the livelihoods of millions of people, as well as causing environmental damage to thousands of kilometres of rivers (Palú & Julien, 2019).

Third raise Second raise First raise Impounded tailings

Upstream construction method Initial embankment First raise Second raise Impounded tailings Third raise

Initial embankment Downstream construction method First raise Second raise Impounded tailings Third raise

Centreline construction method Initial embankment

(Source: Adapted from Vick, 1990)

Figure 1: Different methods of construction for tailings dams

40 Dam “B1” of the Córrego do Feijão mine, referred to in this paper as the Brumadinho tailings dam, was a tailings dam 86 m high with a crest length of 700 m and storage volume of approximately 12 million m3, located 9 km north-east of the town of Brumadinho in the state of in Brazil (Palú & Julien, 2019; Robertson et al., 2019). The dam was built using the upstream construction method over a period of 37 years in 10 raises (Robertson et al., 2019). A cross-section through Brumadinho tailings dam is shown in Figure 2. The last time the dam was raised was in 2013, and tailings disposal ceased in 45 July 2016 (Robertson et al., 2019). The Brazilian Institute of Water Management of Mines and the National Mining Agency had evaluated and classified the dams probability of failure as being “low” (Porsani et al., 2019).

2

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

10 9 8 7 6 5 4 3 Impounded tailings 2

1

Height above (m)sea mean level above Height Subsoil

840 860 880 900 920 940 920 900880 860 840 300 250 200 150 100 50 0 Chainage (m)

(Source: Adapted from Adapted from Robertson et al., 2019)

Figure 2: Cross-section of the Brumadinho tailings dam and the stages in which it was raised

50 At 12:28 pm local time on 25 January 2019, the Brumadinho tailings dam suffered a sudden failure, releasing a mudflow over 10 m deep which moved rapidly downstream (Robertson et al., 2019). The failure extended across much of the face of the dam and its collapse was complete in less than 10 seconds. Around 9.7 million m3 of material were released, approximately 75% of the stored tailings (Robertson et al., 2019). The ~10 million m3 of tailings material flowed out of Brumadinho tailings dam within about five minutes (Robertson et al., 2019). Information derived from a YouTube video of the event indicates that 55 the maximum velocity of the mudflow may have been as high as 33 m/s (Petley, 2019). Three stills from the YouTube video of the , together with the local time at which they were taken, are shown in Figure 3. The official report on the Brumadinho tailings dam failure found that it occurred as a result of static liquefaction (Robertson et al., 2019). The investigation deduced that the failure initiated close to the crest of the dam but very rapidly progressed through the entire structure, allowing a comparatively shallow failure to develop (Robertson et al., 2019). This was then 60 followed by a series of retrogressive failures that released the large volume of mine waste (Robertson et al., 2019). The failure of Brumadinho tailings dam led to hundreds of people losing their lives and immense damage to the environment, as well as people’s livelihoods. There is some anecdotal evidence to suggest that it took the mudflow between 1.5 and 2 hours to reach the River some 10 km downstream of the tailings dam (Xinhua, 2019). The location of Brumadinho tailings dam, the extent of the mud flow, as well as other key locations related to the event are shown in Figure 4. 65

3

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

Time: 12:28:25

Time: 12:28:33

Time: 12:28:49

(Source: YouTube, 2019)

Figure 3: Stills from the YouTube video of the Brumadinho dam failure

Mining developments, including tailings dams, often grow gradually over long periods of time and as a result the responsibility 70 for the direct and indirect risks posed by these operations to downstream communities and the environment is avoided (Downing, 2014; Owen et al., 2020). Following recent tailings dam failures there has been a renewed sense of urgency from industry, civil society, and the investor community to understand the types of risks posed by tailings dams (Owen et al., 2020).

4

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

Legend

Extent of the mudflow caused by the failure Locations A is the tailings dam which failed B is Dam VI, a process water reservoir, destabilized as a result of the event C is the mine office buildings and canteen D is a railway bridge which was destroyed E where the mud flowed into into the Paraopeba River

0 1 2 km

(Source: European Space Agency Copernicus Sentinel-2A-L1C Satellite image and OpenStreetMap.org contributors, the image contains 75 modified Copernicus Sentinel data 2019)

Figure 4: Location of the Brumadinho tailings dams and the extent of the mudflow

The main objectives of this work were to: • Highlight the use of an agent-based model and other modelling tools to estimate the risk to people downstream of the Brumadinho tailings dam 80 • Assess if the number of fatalities could have been reduced if a warning had been received prior to or at time the dam failed, albeit one with a short lead time1 • Demonstrate how these modelling tools can help to inform emergency plans for tailings dams Three separate models were used in this research as follows: • A dam breach model known as EMBREA-MUD specially developed to model tailings dam breaches which was used to 85 help to generate an outflow hydrograph of the tailings. • A two dimensional hydrodynamic model of the non-Newtonian mud flow which provided depths and velocities of the mudflow at five second intervals.

1 The lead time is the time between a warning being issued and an event occurring. 5

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

• An agent based model of people and vehicles, called the Life Safety Model (LSM), which was used to assess the loss of life and how warnings of the imminent failure could have reduced the death toll.

90 2 Modelling of the Brumadinho tailings dam failure

A two-fluid dam breach model, known as EMBREA-MUD, was initially used to model the Brumadinho tailings dam failure EMBREA-MUD models water and tailings and provides times series of water and tailings outflows in the form of hydrographs which can be used as the input to a downstream model of the subsequent mudflow. EMBREA-MUD is based on the EMBREA model, developed over a 20 year period by HR Wallingford, which simulates embankment dam breaches and was first 95 developed by Mohamed et al. (2002) under the name HR BREACH and validated against a number of dam failures case studies including the Orós dam in Brazil in 1961, the Banqiao dam in China in 1975 (Morris 2011) and the Teton dam in USA in 1976 (Mohamed et al. 2002). EMBREA-MUD predicts the growth of a breach in tailings dams via a range of processes, as well as the quantity of water and tailings released from the dam in the form of a hydrograph (Mohamed et al. 2002; Petkovšek et al., 2020). Both processes, 100 breaching and outflowing, are simulated simultaneously based on the characteristics of the dam material, predicting the evolution of breach opening without the need to make assumptions regarding the dimensions of the breach. EMBREA-MUD has been validated against two tailings dams failures; the Merriespruit tailings dam failure in South Africa in 1994 and the Mount Polley tailings dam failure in British Columbia in in August 2014 (Petkovšek et al., 2020). The EMBREA-MUD breach model of the Brumadinho tailings dam comprised three layers as follows: 105 • Water layer including eroded tailings and dam material in suspension which behaves as a Newtonian fluid2. • Mud layer with a viscoplastic non-Newtonian behaviour representing the liquefied tailings. • Solid comprising material making up the tailings dam. Soon after the Brumadinho tailings dam failed in January 2019, EMBREA-MUD was used to develop two breach scenarios: a “base” scenario and an “extreme” scenario. Both these scenarios were based on a total mobilised volume of material of ~7.2 110 million m3. Both breach scenarios were assumed to have taken place over two minutes. The base scenario had a peak flow of 160,000 m3/s and the extreme scenario had a peak flow of 350,000 m3/s. In December 2019 Robertson et al. released their expert panel report on the technical causes of the Brumadinho tailings dam failure (see Robertson et al., 2019). This report indicated that the quantity of material was about 35% higher than had originally been assumed in the EMBREA-MUD model and that it took around five rather than two minutes for all the mobilised material to leave the location of the failure (Location 115 A on Figure 4). Utilising the information in the expert panel report a breach hydrograph was developed based on the simplified shape of the extreme scenario modelled using EMBREA-MUD but using the mobilised material volume specified in the expert report and

2 A Newtonian fluid is a fluid in which the viscous stresses arising from its flow, at every point, are linearly correlated to the local strain rate, he rate of change of its deformation over time 6

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

representing the progressive failure of the dam. The maximum mudflow discharge of 90,000 m3/s is reached within five seconds. The shape of the outflow hydrograph, shown in Figure 5, was based on information in the expert panel report, which 120 stated that the dam failed progressively, and also the velocity at which the mudflow travelled based on a high quality YouTube video of the incident (see YouTube, 2019).

100,000

90,000

80,000

70,000

60,000

/s) 3 50,000

Flow (m Flow 40,000

30,000

20,000

10,000

0 0 50 100 150 200 250 300 Time (seconds)

Figure 5: Assumed outflow breach hydrograph developed for the Brumadinho tailings dams failure in January 2019

3 Modelling of the mudflow resulting from the Brumadinho tailings dam failure

125 Outflow from the Brumadinho tailings dam was a mixture of the dam itself, tailings and water (Robertson et al., 2019). This mixture did not behave in the same manner as floodwater; it behaved as a rheological material. Rheological flows are gravity- driven mass flows whose dynamic behaviour is akin to a non-Newtonian fluid (De Blasio, 2011) and which are characterised by changes in viscosity in response to the strain rates within the fluid. The use of a method, which uses the Bingham plastic rheological model, has been shown to be a good approximation for the flow of liquefied tailings (Jeyapalan et al, 1983). 130 The mudflow generated by the Brumadinho tailings dam failure was modelled using MIKE 21. MIKE 21 is a two dimensional hydrodynamic model which can model mudflows. The mudflow flow model extended from the location of the Brumadinho tailings dam (location A in Figure 4) to the confluence with the Paraopeba River. (location E in Figure 4) a distance of some 10 km in total. MIKE 21 uses the full Bingham model (Bingham, 1916), which is based on the 2006 work by Naef et al (Naef

et al., 2016). The model determines the flow resistance term 0/gh from the following equation (Naef et al, 2006):

7

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

휇 푞 135 2휏3 − 3 (휏 + 2 퐵 ) 휏2 + 휏3 = 0 0 푦 ℎ2 0 푦 Where: q is the flux in terms of discharge per unit width h is the fluid depth

µB is the Bingham fluid viscosity

140 τy is the yield stress

τ0 is the shear stress

MIKE 21 solves the equation numerically to give τ0 as a function of τy (the yield stress), τB (the Bingahm viscosity), h and q. The three inputs to the MIKE 21 model are fluid density in kg/m3, yield stress in N/m2 and the dynamic viscosity in kg/m.s. There were no field or laboratory measurements available for the Brumadinho mudflow so the rheological properties of 145 mudflows were derived using information from the expert panel report (Robertson et al., 2019), a high quality video of the event and remote sensing information which showed the maximum extent of the mudflow. The selection of the three key parameters for the MIKE 21 mudflow model are discussed below: 1. Fluid density – MIKE 21 only allows a single fluid density to be used. A value of 1,800 kg/m3 was found to be appropriate because this density reflects the combination of the tailings, the embankment and the fluids within the tailings dam. Values 150 were derived from the expert panel into the dam failure (Robertson et. al, 2019), as well as the work done by Rickenmann (1999) and Rickenmann et al, (2006). 2. Yield stress – The mudflow model was tested using a range of yield stresses between 400 N/m2 and 4,000 N/m2. The mudflow model results showed that using high yield stresses (i.e. >1,500 N/m2) prevented the flows from reaching the Paraopeba River. Conversely, yield stresses <500 N/m2 resulted in flows reaching the Paraopeba River too quickly. Values 155 of between 750 N/m2 and 1,000 N/m2 meant that time of the mudflow arrival at the Paraopeba River matched those reported. 3. Bingham fluid viscosity – The mudflow model was run two fluid viscosity values, 30 kg/m.s and 100 kg/m.s. The results showed that the higher value gave a better match between the observed and modelled mudflow extents. In addition to the above parameters the roughness of the floodplain needed to be set. The MIKE 21 mudflow model uses 160 “Manning’s M” as an input parameter for roughness. Manning’s M is the inverse of Manning’s n roughness coefficient (i.e. 1 ). The values of Manning’s M and their equivalent n values used in the model are given in Table 1. 푛 The roughness values in Table 1 are based on those in standard texts such as Chow (see Chow, 1959). The Airbus WorldDEM Digital Terrain Model (DTM) which represents a bare earth surface on a 0.4 arcsecond grid (approximately 12 m) was used to represent the topography of the downstream valley. The accuracy of this earth observation 165 based DTM surpasses that of any global satellite-based elevation model available. Previous modelling of the Brumadinho mudflow used the HEC-RAS hydrodynamic modelling software, which can only model Newtonian flows and used a less accurate 30 m grid DTM (see Raman & Liu, 2019). In the MIKE 21 mudflow model, a flexible triangular mesh was used with

8

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

a maximum element area of 150 m2. The mesh comprised a total of some 169,000 elements, which covered the area from the toe of the Brumadinho tailings dam (Location A on Figure 4) to the Paraopeba River (Location E on Figure 4). The inflows 170 to the two dimensional mudflow model were applied at the base of Brumadinho tailings dam (Location A on Figure 4). Table 1. Manning’s M roughness values used in the mudflow model Type of land use Manning’s M value Equivalent Manning’s n Forest and jungle 6 0.167 Pasture 16 0.063 Mine workings 32 0.031 Buildings 4 0.250 This Brumadinho tailings dam failure was a rarity in that there are high quality video images of the event, which provide an insight into the failure mechanism, the speed at which the mudflow initially moved downstream and the approximate time at which some of the buildings were destroyed. The results of the mudflow modelling showed that the outputs provided a good 175 representation of the actual event both in terms of reproducing the maximum mudflow envelope, as well as the velocity at which the flow moved based on the video of the event and other evidence available. Figure 6 shows a comparison between the maximum modelled mudflow and the maximum extent estimated from remote sensing data and Table 2 provides the modelled mudflow depths and arrival times at key locations. The mudflow maximum extent agreed well with the observed extent from the remote sensing data. Where there are differences this are mainly a result 180 of the DTM and the challenges in estimating the exact maximum mudflow extent from the remote sensing data available at the time of the disaster. The mudflow model was run using a five second time step which provides a suitable fine temporal resolution for the loss of life and evacuation modelling carried out as part of this work. Table 2. Modelled mudflow depths and arrival times at key locations Location Location on Modelled arrival time of the Modelled maximum depth of Figure 4 mudflow after the failure mudflow (m) (hours: minutes: seconds) Canteen C 00:01:30 18.7 Railway bridge D 00:09:10 16.6 Paraopeba River E 01:26:05 11.6

4. Loss of life and evacuation modelling

185 4.1 Introduction

At least 270 people perished as a result of the collapse, most of them employees of the mine. The mine’s canteen and administrative offices, as well as three locomotives and some 130 wagons, were buried in the mine plant area (Porsani, 2019). The mudflow destroyed some parts of the Córrego do Feijão district, including a nearby inn and several rural properties, as 9

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

well as sections of railway bridge and about 100 m of railway track. Agricultural areas in the valley below the dam were also 190 damaged by the failure (Porsani, 2019). It is essential that the risks to people associated with tailings dams be evaluated rigorously and managed proactively at all stages of their lives so that the risks posed by a failure remains As Low As Reasonably Practicable (ALARP) (Bowles, 2003). This section of the paper describes the modelling of the risk to people using an agent-based model and investigates if the risk to people could have been reduced via the use of warnings and designated evacuation routes. 195

Figure 6: Comparison of the maximum modelled mud extent and the observed maximum mud extent downstream of the Brumadinho tailings dams

4.2 Background to the Life Safety Model (LSM) and people at risk modelling

200 To model the loss of life and how this could have been reduced an agent-based model called the Life Safety Model (LSM) was employed. The LSM is an agent-based model3 which allows the behaviour of each person at risk to be represented. The initial

3 An agent-based model comprises a collection of autonomous decision-making entities called agents. Each agent individually assesses its situation and makes decisions on the basis of a set of rules. 10

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

development of the LSM commenced in 2002 by BC Hydro, a Canadian electricity utility and Canada’s National Research Council, and since 2009 it has been further developed by HR Wallingford. Prior to the development of the LSM, simple empirical methods were such as those developed by the US Bureau of 205 Reclamation (see Graham, 1999; USBR, 2014) were mainly used to assess the risk to people from dams. These models are based on limited data sets, include few large dams (i.e. greater than 15 m high) and also mix cases of where warnings were and were not received (Assaf & Hartford, 2001) and, although commonly used, owing to their limitations they are not particularly helpful in formulating emergency plans. The LSM simulates the interaction of people with the modelled flood or mudflow. Not only is this approach more transparent and defensible than empirical methods, but it allows scenarios to be 210 investigated that could help to reduce the risk to people (e.g. improvements in warnings, development of new evacuation routes). The LSM has been validated for a number of historical dam failures (see Lumbroso et al., 2011; Johnstone & Garret, 2014) and used to assess the risks to people and improve emergency planning in 12 countries worldwide (Lumbroso & Di Mauro, 2008; Lumbroso et al., 2010; Lumbroso & Davison, 2018). The number of people at risk before the Brumadinho tailings dam collapsed was estimated to be 502. This number included 215 the number of people working in the mine’s buildings including the canteen directly downstream of the dam, as well as people residing in houses in villages further downstream The number of people at risk was an estimate based on the best available information from media reports. It is important to note that there is likely to be a relatively high degree of uncertainty in the estimated number of people at risk (e.g. ±25%). The number of people at risk was built up as follows: • The dam failed at lunch time and many of the works were eating in the staff canteen. It was assumed that there were 200 220 people in the canteen at the time of the incident. Media reports point to the canteen being the worst hit in terms of fatalities; • In addition, it was assumed that there were 10 people in each of the other site buildings, most of which were located near to the canteen, giving a total of 400 people on the site; • The number of residential buildings at risk was estimated from remote sensing data and the maximum observed flood extent. It was estimated that there 51 houses at risk and that at the time of the dam collapse each house had two people in 225 them The LSM has a function which relates the damage and possible collapse of buildings to the velocity and depth of the flow. The majority of buildings in the LSM model were considered to be of an average masonry construction, which means that significant damage and collapse will only commence after the combination of the maximum velocity and depth of the flow exceeds 10 m2/s. The mine buildings were assumed to be constructed of “average concrete”, which means that significant 230 damage and failure will commence after the combination of the maximum velocity and depth of the flow exceeds 20 m2/s. At the location of the mine buildings, the maximum combination of mudflow depth and velocity was in excess of 50 m2/s meaning that all the buildings would have collapsed. The LSM modelling considered both vehicular and on foot evacuation routes. These possible evacuation routes were digitised from remote sensing data. The pathways and trails were set up in the LSM to only allow pedestrian access and only existing 235 roads were set up to take vehicles. The evacuation routes used in the LSM were based on existing paths and roads. In the

11

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

LSM the evacuation route from each building is determined by the shortest route to a safe location. Safe locations were placed at heights above the maximum flood depth at the end of each evacuation route. The location of the buildings, evacuation routes and safe locations are shown in Figure 7. More information on the technical details of the LSM are available in Lumbroso & Davison, 2018 together with various other publications available at . 240 http://www.lifesafetymodel.net/publications.html Two evacuation scenarios were considered in the modelling as follows: • Everybody at risk evacuating from the area at risk on foot • Half of the 400 mine workers evacuating by vehicle and half by foot, with villagers downstream evacuating on foot. In this scenario it was assumed that there were 40 pickup trucks available and that each one had the capacity for five mine 245 workers Velocities and depths from two dimensional, mudflow model were used to provide the hazard posed to the modelled agents (e.g. people, vehicles and buildings) in the LSM. Figure 8 shows how the results of the external hydraulic model are linked to the LSM.

250 Figure 7: Location of buildings, safe locations and evacuation routes downstream of the Brumadinho tailings dams

12

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

When developing the two dimensional mudflow model and the LSM, both models need to be discretised at suitable, regular temporal (Δt) and spatial intervals (Δx), as shown in Figure 8. This is because as the mudflow evolves, the interaction of people and vehicles with the mudflow at each time step affects the loss of life and the evacuation times. For this modelling a times step of 5 seconds was used. This is considerably smaller than the time step to meet mudflow modelling stability criteria; 255 however, a time step that is too large, (e.g. 5 minutes), will result in people moving a large distance (e.g. ~250 m to ~500 m on foot and several kilometres in a vehicle) during each temporal interval and thus escaping the advancing mudflow, which may not be the case if a shorter time step is used. Similarly if the spatial discretisation (Δx) of the mudflow model is too large (e.g. >15 m) then the velocities and depths at each time step are averaged over a large area leading to a loss of resolution of the hazard, which also adversely impacts the accuracy of the results (Lumbroso & Davison, 2018). 260 Each person (i.e. agent) in the LSM can have six states as follows: • “Unaware” – The person does not know that the mudflow is happening either because it has not reached them or because they have not received a warning • “Aware” – The person is conscious that the dam break has occurred either because they have received a warning in advance or the mudflow has reached them 265 • “Evacuating” – The person is making a conscious effort to reach safety (i.e. a defined location outside the area at risk) by a designated evacuation route • “Safe” – The person has reached safety and is no longer at risk • “Injured” – The person has been knocked over by the flow but is not fatally injured • “Deceased” – The person has died as a result of the mudflow 270 Further details on the LSM model can be found in Lumbroso & Davison, 2018; Lumbroso et al., 2011; Di Mauro & Lumbroso, 2008 and Johnstone, 2012.

13

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

Mudflow depth Mudflow velocity t1 Spatial Results from an interval Temporal external Δx interval Δt two dimensional t mudflow model Δx 2

t3 . . .

. (increasing) Time . . tn

Duration of the mudflow modelling simulation = n Δt Δx Building Person Δx Life Safety Model including a representation of the population at risk, vehicles, buildings, roads and paths Path or road

Figure 8: Schematic diagram showing how results from a two dimensional fully hydrodynamic mudflow model are linked to the LSM

Figure 9 shows an example of the output from one time step of the Brumadinho LSM modelling. Table 3 provides the results 275 of the LSM modelling showing people’s different states. Five scenarios were modelled. The actual event together with scenarios where warnings were exactly at the point of failure, as well as 5, 10 and 15 minutes before the dam failed. Animations of the LSM modelling for three of the modelled scenarios and some of the GIS files used in the modelling are available to download (see Lumbroso, 2020). Two methods of evacuation were considered (i) on foot only (ii) a combination of vehicles and on foot.

14

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

280 Figure 9: An example of an output from the LSM emergency planning modelling 90 seconds after the Brumadinho tailings dam failure assuming a warning is issued at the time of the breach

The report number of fatalities as a result of the Brumadinho tailings dam failure was probably between ~270 and ~310 (Mining Journal, 2020; Keaveny, 2019). The results of the LSM model indicated that with no warning there would 456 fatalities out 285 of the 502 people assumed to be at risk, a 91% fatality rate, with a warning at the exact time the dam failed there would have been 354 fatalities. The actual event is best represented by a combination of no warning scenario on the mining site and a warning at the time of breach because the people in the villages further downstream became aware of the disaster without an official warning and many of them escaped the mudflow. There is some indication from media that there were between 5 and 20 deaths in Parque da Cocheira village also evidence that 66 buildings were destroyed in this location (Diario Do Nordeste, 290 2020; Terra, 2020). The LSM model indicated that there would be 42 fatalities with no warning in Parque da Cocheira village and that 43 houses collapsed or badly damaged.

15

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

295 Table 3. Results of the Life Safety Model (LSM) Scenario modelled Estimated number of fatalities with people Estimated number of fatalities with people escaping on foot only escaping on foot and in vehicles Mining site Villages Total Mining site Villages Total No warning 382 74 456 382 74 456 Warning at the time 350 4 354 295 4 299 of the breach Warning 5 minutes 256 0 256 186 0 186 before failure Warning 10 200 0 200 100 0 100 minutes before failure Warning 15 0 0 0 0 0 0 minutes before failure Producing “accurate” estimates of fatalities caused by tailings dam failures is challenging to achieve given the uncertainty associated with natural variability, dependent on chance (US Department of Homeland Security, 2011), together with the spatial location of people when the event occurs. In the case of the Brumadinho event there was only anecdotal evidence available with respect to the number of mine workers in the canteen and other buildings, as well as the number of people in 300 houses downstream that were at risk. The value of using complex loss of life models is not to estimate the exact number of deaths, but to assess if emergency management interventions can make a significant difference in reducing the likely fatalities should the worst happen (Lumbroso & Davison, 2018). This information can then be used to inform emergency plans to make them more effective. If a warning had been received at the exact time the dam failed, and assuming that people took one minute to react and knew 305 where to evacuate to, the number of fatalities could have been reduced from a total of 456 to 354 or 299 depending on the method via which people were assumed to have evacuated. This is a reduction in the death toll of between 102 to 157. A warning five minutes before the dam failed could have reduced the number of fatalities by 200 and 270 and a warning received 15 minutes before the failure could have reduced the number of deaths to zero.

5. Discussion

310 The probability of a tailings dam failing is relatively high compared to other infrastructure that pose similar risks to people and the consequences of a failure are also high. In addition, even if there are no people directly at risk, the pollutants released into the environment can have health implications for those living further downstream, as well as impact the environment and

16

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

people’s livelihoods. For example, in 1998 the failure of a tailings dam at Boliden Apirsa’s mine in southern Spain led to over 40 km river being polluted and 2,600 ha of agricultural land being covered with tailings (Emery, 2005). The lack of an 315 emergency plan addressing this particular situation meant that the clean-up operation was not effective as it could have been because responsibilities and objectives were established after the event (Emery, 2005). The lack of a coherent plan led directly to five fatalities on public roads during the clean-up operation (Emery, 2005). It is often not possible to reduce the risk posed by tailings dam to zero. In many countries the philosophy adopted to risk is reducing risks as low as reasonably practicable (ALARP). The ALARP principle is founded on the obligation of tailings dam 320 owners to reduce risks to the point that additional risk reduction would “cost” “disproportionally” more than the risk reduction (i.e. benefit) achieved (Bowles, 2003). To evaluate if the ALARP principle has been met for a tailings dam it is necessary to firstly quantify the risk and then to assess any “physically possible” structural or non-structural options that could further reduce the risk (Bowles, 2003). The ALARP principle is an important consideration in the US Bureau of Reclamation’s Public Protection Guidelines (USBR, 2003) and an important factor in the UK’s Health and Safety Executive’s decision-making 325 process (HSE. 2001) with respect to societal risk. Societal risk is defined as the relationship between frequency (or probability) of an event occurring and the number of people suffering from a specified level of harm in a given population from the realisation of specified hazards (Jones, 1985). The assessment of societal risk is concerned with the estimation of the probabilities of more than one individual being harmed simultaneously by an incident (HSE, 2009). Societal risk can be represented by “F-N curves” which are plots of the cumulative 330 frequency (F) or probability of various accident scenarios occurring against the number (N) of fatalities associated with the modelled incidents (HSE, 2009). Figure 10 shows four F-N curves for the acceptable societal risk for dam failures and major accidents in Australia, UK and USA. Given that the annual probability of failure of a tailings dam is approximately 1 x 10-2 and that when these structures do fail they often lead to at least one direct or indirect fatality, it can be seen that the risks they pose to society are “unacceptable” and ”intolerable”.

17

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

1 x 10-2 Risks are intolerable 1 x 10-3 Risks are intolerable Limit of tolerability for -3 except in extraordinary 1 x 10 existing dams -4 circumstances 1 x 10 Full standards -4 Limit of tolerability 1 x 10 based approach required as a 1 x 10-5 for existing dams 1 x 10-5 minimum Limit of tolerability 1 x 10-6 for new dams 1 x 10-6

-7 1 x 10 Risks are tolerable if they -7 1 x 10 Risk are satisfy the ALARP failure of probability Annual negligible Annual probability of failure of probability Annual requirements -8 1 x 10 1 x 10-8 1 10 100 1,000 10,000 1 10 100 1,000 10,000 Number of fatalities from dam failure Number of fatalities from dam failure

(b) Australian National Committee On Large Dams (b) New South Australia

1 x 10-2 R2P2 upper limit Risks are 1 x 10-3 for 50 fatalities unacceptable Societal risk limit for 1 x 10-3 existing dams Risks are HSE’s Reducing -4 1 x 10 unacceptable 1 x 10-4 Risks, Protecting except in People (R2P2) document exceptional 1 x 10-5 1 x 10-5 circumstances

1 x 10-6 1 x 10-6 Low probability – high consequence events

1 x 10-7 Annual probability of failure of probability Annual 1 x 10-7 Risks are tolerable if they ALARP region satisfy the ALARP 1 x 10-8

requirements Annual probability of failure of probability Annual 1 x 10-8 1 x 10-9 1 10 100 1,000 10,000 1 10 100 1,000 10,000 Number of fatalities from dam failure Number of fatalities

(c) US Army Corps of Engineers (d) UK Health and Safety Executive (HSE) 335 (Sources: ANCOLD, 2003; HSE, 2001; NSW Department of Planning, 2011; USACE, 2011)

Figure 10: Graphs showing the acceptable risk in terms of annual probability of failure and loss of life for dams in the Australia and the USA and major hazards in the UK

18

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

Effective emergency plans can help to reduce the risks posed by tailings dam failures. The effectiveness of an emergency plan 340 depends on the scenarios studied and how well the plan is disseminated. Dam owners in Brazil are responsible for preparing the emergency action plans, however, these are often not checked by the relevant government authorities (Sampaio, 2016). It is important that an emergency plan is based on evidence-based dam break scenarios and inundation maps of possible extents of the mudflow, as well as the social, economic and environmental impacts (Sampaio, 2016). Plans need to be revised periodically and procedures should be established so that if a failure is likely to or has occurred a warning can be effectively 345 disseminated to the people affected population and the area can be evacuated to minimise the number of victims. In Brazil a federal law related to emergency planning for dams only came into effect in 2010 (Sampaio, 2016). This law established a National Dam Safety Policy and created the National Dam Safety Information System (Sampaio, 2016). Tailings dam owners in Brazil have to produce an Emergency Action Plan for each of their dams (Sampaio, 2016). There is a real danger that emergency plans for tailings dams are not realistic or effective. In his book “Mission improbable: 350 Using fantasy documents to tame disasters”, Clarke points out that for many emergency planners, it can be easier to produce symbolic, “fantasy” documents than to engage in forthright admissions of the real dangers and the uncertainties that they create (Clarke, 1999). For example, in November 2015 a tailings dam near the town of Bento Rodrigues in the state of Minas Gerais in Brazil failed, releasing more than 30 million m3 of water and mine waste killing 19 people and polluting hundreds of kilometres (Agurto-Detzel et al., 2016). An emergency plan had been developed for the dam. However, the risks that were 355 incorporated in the plan were not sufficiently assessed. The emergency plan for the dam, submitted to the Brazilian environmental authorities, stated that in the event of a failure the mudflow would only reach the town of Bento Rodrigues 2.5 km downstream of the dam (De Carvalho, 2019). In reality the tailings released from the dam polluted some 700 km of watercourses downstream of the mine (De Carvalho, 2019). The production of ineffective emergency plans is not something that is unique to Brazil, as a numerous disasters worldwide 360 have shown. For emergency plans for tailings dams to be effective they need to be realistic and meaningful to regulators and stakeholders. In preparing emergency plans there is sometimes a philosophy of “this will never happen, so why do we need to care?”. This is especially true for events that are perceived to have a low probability of occurrence. This can lead to some organizations suffering from a “it can’t happen here” mentality (McConnell & Drennan, 2006) and for the “worst case scenarios” not to be considered because they are perceived to be purely “hypothetical” (Clarke, 2006). However, things that 365 have never happened before, happen all the time (Sagan, 1993). Research has found that in France and the UK tools to assess evacuation times and loss of life for floods appear to be rarely used by emergency planners (Lumbroso & Vinet, 2012). This means that these risks and the way they can be reduced are rarely evaluated in a quantitative manner using a phenological, rather than empirical, approach that provides a transparent basis for making interpreting the various outcomes. In Brazil and in many other countries emergency plans for tailings dam are often 370 not a high priority. The inadequate planning for the 2015 Bento Rodrigues tailings dam disaster, included the absence of response planning, the lack of an effective alarm system, as well as no quantitative or qualitative description of the worst-case scenarios (De Carvalho, 2019). In Brazil there has been a lack clarity about the minimum contents required for emergency

19

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

plans and rather than being an essential tool for risk management and response planning they end up being “a mere bureaucratic formality” (De Carvalho, 2019). 375 The employment of breach, inundation and agent-based risk to people models (i.e. the Life Safety Model (LSM)) allow the risks to people from tailings dam failures to be quantified and, more importantly, strategies for reducing this risk to be evaluated in an evidence-based manner. Work on tsunamis has shown that, despite the short lead time for a near-field tsunami, there is still value in providing rapid warnings to the people at risk providing people know where to evacuate to (National Research Council, 2011) and are useful for saving lives. This research has shown that this is also the case for tailings dam. The sirens 380 designed to warn nearby communities and workers of any problems with the Brumadinho dam did not sound. However, if they had sounded as the dam failed this research has shown that even a warning just as the dam was failing could have saved between 100 and 150 lives.

6. Conclusions and recommendations

For emergency plans to be effective it is important that they incorporate foresight about the changing nature of risk, and 385 facilitate evidence-base action, before people are harmed. There have been models and frameworks (see Tagg et al., 2012) that can be employed to estimate risk. Often agent-based models are seen by government regulators as being “expensive” to implement compared to simple empirical methods. However, compared to the costs caused in terms of loss of life and injuries to people they can be an effective tool which can contribute to emergency plans, especially with respect to evacuation planning. The LSM agent-based model provides a useful tool via which this can be done and provides an evidence-based way of 390 exploring ways of reducing risks to people. Author contributions: All authors contributed to the research carried out as part of this study. MD developed and ran the Life Safety Model. RB developed and ran the mudflow model. GP provided advice on tailings dam breaching and ran the EMBREA-MUD model. DL co- ordinated the research, and provided advice on loss of life and hydraulic modelling, as well as writing the text. Competing interests: The authors declare no competing interests. 395 Acknowledgements: The authors would like to acknowledge the Satellite Applications Catapult in the UK and the UK Space Agency’s International Partnership Programme for supporting this work.

References

Agurto-Detzel, H., M. Bianchi, M. Assumpção, M. Schimmel, B. Collaço, C. Ciardelli, J. R. Barbosa, J. and Calhau, J. The tailings dam failure of 5 November 2015 in South-East Brazil and its preceding seismic sequence, Geophysical Research 400 Letters, 43, 4929–4936, doi:10.1002/2016GL069257, 2016 Assaf, H. and Hartford, D.N.D. Physically-based modelling of life safety considerations in water resource decision-making, World Water and Environmental Resources Congress, The Rosen Plaza Hotel, Orlando, Florida, USA, 20 to 24 May, 2001

20

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

Australian National Committee On Large Dams (ANCOLD) Guidelines on risk assessment, published by the Australian National Committee on Large Dams, Tatura, Victoria, Australia, 2003 405 Azam, S. and Li, Q. Tailings dam failures: A review of the last one hundred years, Geotechnical News, December 2010, pp50- 53, 2010, available at: http://ksmproject.com/wp-content/uploads/2017/08/Tailings-Dam-Failures-Last-100-years- Azam2010.pdf last access: 27 March 2020 Bingham, E.C. An investigation of the laws of plastic flow, Bulletin of the Bureau of Standards. 13 (2): 309–353. doi:10.6028/bulletin.304. hdl:2027/mdp.39015086559054, 1916 410 Bowker, L.N. and Chambers, D.M. In the dark shadow of the supercycle tailings failure risk and public liability reach all-time highs, Environments 2017, 4, 75; doi:10.3390/environments4040075, 2017 Bowles, D. ALARP evaluation: Using cost effectiveness and disproportionality to justify risk reduction, Proceedings of the Australian Committee on Large Dams Risk Workshop, Launceston, Tasmania, Australia, October, 2003 Chow, V.T. Open-channel hydraulics, published by McGraw-Hill, New York, USA, 1959 415 Clarke, L. Mission improbable: Using fantasy documents to tame disasters, published by the University of Chicago Press, Chicago, USA, 1999 Clarke, L. Worst cases: Terror and catastrophe in the popular imagination, published by the University of Chicago Press, Chicago, USA, 2006 De Carvalho, D.W. The tailings dam rupture disaster in Mariana, Brazil 2015: What we have to learn from anthropogenic 420 disasters, Natural Resources Journal, Vol 59, Issue 2, Summer, 2019 De Blasio, F.V. An introduction to the physics of landslides: Lecture notes on the dynamics of mass wasting, ISBN 978-94- 007-1121-1, published by Springer, Dordrecht, The Netherlands, 2011 Diario Do Nordeste Um ano após catástrofe, Brumadinho segue paralisada, Available at: https://diariodonordeste.verdesmares.com.br/editorias/pais/online/um-ano-apos-catastrofe-brumadinho-segue-paralisada- 425 1.2201581, 2020 last access:22 April 2020 Di Mauro, M. and Lumbroso, D. Hydrodynamic and loss of life modelling for the 1953 Canvey Island flood, Flood Risk Management, Proceedings of FLOODrisk, Oxford University, UK 2008 Downing, T.E. Does the Kosovo Power Project’s proposed forced displacement of Kosovars comply with international involuntary resettlement standards? The Kosovo Civil Society Consortium for Sustainable Development, 2014 430 Emery, A. Good practice in emergency preparedness and response, published by the International Council on Mining and Minerals, September, 2005 Graham, W.J. A procedure for estimating loss of life caused by dam failure DSO-99-06, US Department of Interior Bureau of Reclamation Dam Safety Office Denver, Colorado, USA, 1999 Health and Safety Executive (HSE) Reducing risks, protecting people: HSE’s decision-making process, Risk Assessment 435 Policy Unit, HSE Books, Her Majesty’s Stationery Office, London, UK, 2001

21

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

Health and Safety Executive (HSE) Societal risk: Initial briefing to Societal Risk Technical Advisory Group, published by Her Majesty’s Stationery Office, Norwich, UK, 2009 International Commission On Large Dams (ICOLD) Tailings dams: Risk of dangerous occurrences, lessons learnt from practical experiences, United Nations Environmental Programme (UNEP), Division of Technology, Industry and Economics 440 (DTIE) and International Commission on Large Dams (ICOLD), Paris, France, Bulletin 121, 2001 Jeyapalan, J.K., Duncan, J.M. and Seed, H.B. Analyses of flow failures of mine tailings dams. Journal of Geotechnical Engineering, ASCE 109(2): 150–171, 1983 Johnstone, W.M. Life safety modelling framework and performance measures to assess community protection systems: Application to tsunami emergency preparedness and dam safety management, Doctor of Philosophy, University of British 445 Columbia, Canada, October, 2012 Johnstone, W.M. and Garrett, M. Return to Malpasset: Using the Life Safety Model to assess the effectiveness of community evacuation plans, ASDSO Annual Conference, 21-24 September 2014, San Diego, USA, 2014 Jones, D. Nomenclature for hazard and risk assessment in the process industries, 2nd Edition. IChemE, 1985 Kossoff, D., Dubbin, W.E., Alfredsson, M., Edwards, S.J., Macklin, M.G. and Hudons-Edwards, K.A. Mine tailings dams: 450 characteristics, failure, environmental impacts and remediation. Applied Geochemistry 51 229-245, 2014 Keaveny, P. Brumadinho dam collapse: Mining industry needs radical change to avoid future disasters, 8 March 2019, The Conversation, 2019 available at: https://theconversation.com/brumadinho-dam-collapse-mining-industry-needs-radical- change-to-avoid-future-disasters-112808 last access 8 April 2020 Lumbroso, D. and Di Mauro, M. Recent developments in loss of life and evacuation modelling for flood event management 455 in the UK, International Conference on Flood Recovery, Innovation and Response (FRIAR), 2 to 3 July 2008, London, UK, 2008 Lumbroso, D., Johnstone, W., De Bruijn, K., Di Mauro, M., Lence, B. and Tagg, A. Modelling mass evacuations to improve the emergency planning for floods in the UK, the Netherlands and North America presented at the International Conference on Emergency Preparedness (InterCEPt), the Challenges of Mass Evacuation, 21 to 23, September 2010, University of 460 Birmingham, UK, 2010 Lumbroso, D., Sakamoto D., Johnstone, W., Tagg, A. and Lence, B. The development of a Life Safety Model to estimate the risk posed to people by dam failures and floods, Dams and Reservoirs, British Dam Society, Vol 21, Issue 1, March, 2011 Lumbroso, D. and Davison, M. Use of an agent-based model and Monte Carlo analysis to estimate the effectiveness of emergency management interventions to reduce loss of life during extreme floods, Journal of Flood Risk Management, Vol 465 11, Issue S1, January 2018, ppS419-S433, 2018 Lumbroso, D. and Vinet, F. Tools to improve the production of emergency plans for floods: are they being used by the people that need them? Journal of Contingencies and Crisis Management, 20, (3), pp149–165, September, 2012

22

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

Lumbroso, D., McElroy, C., Goff, C., Roca Collell, M., Petkovšek, G. and Wetton, M. The potential to reduce the risks posed by tailings dams using satellite-based information, The International Journal of Disaster Risk Reduction, Volume 38, June, 470 2019 Lumbroso, D. Brumadinho tailings dam, Brazil model animations of mudflow and risk to people plus GIS files, Version 1, https://zenodo.org/record/3872788#.XtYMoW5Fzf0 doi 10.5281/zenodo.387, 2 June 2020 Lyu, Z., Chai , J., Xu, Z., Qin, Y. and Cao, J. A comprehensive review on reasons for tailings dam failures based on case history, Advances in Civil Engineering, Vol 2019, Article ID 4159306, https://doi.org/10.1155/2019/4159306, 2019 475 Martin, T.E and McRoberts, E.C. Some considerations in the stability analysis of upstream tailings dams in Proceedings of Sixth International Conference on Tailings and Mine Waste ’99, 24-27 January 1999, Fort Collins, Colorado, USA, 1999 McConnell, A. and Drennan, L. Mission impossible? Planning and preparing for a crisis, Journal of Contingencies and Crisis Management, Volume 14, Number 2, pp. 59–70, 2006 Mining Journal March underway to Brumadinho to mark year since fatal dam collapse, 21 January 2020, available at: 480 https://www.mining-journal.com/politics/news/1379365/march-underway-to-brumadinho-to-mark-year-since-fatal-dam- collapse last access 8 April 2020 Mohamed, M.A.A.H., Samuels, P.G., Morris, M.W. and Ghataora, G.S. Improving the accuracy of prediction of breach formation through embankment dams and flood embankments. Proceedings of the international conference on fluvial hydraulics (Riverflow 2002), 3 to 6 September 2002. Louvainla-Neuve, France, 2002 485 Morris, M.W. Breaching of earth embankments and dams. PhD thesis, The Open University, UK, 2011 Naef, D., Rickenmann, D., Rutschmann, P. and McArdell, B.W. Comparison of flow resistance relations for debris flows using a one-dimensional finite element simulation model, Natural Hazards and Earth System Sciences, Vol. 6, pp. 155-165. 2006 National Research Council, Tsunami warning and preparedness: An assessment of the US tsunami program and the nation's preparedness efforts. Washington, DC, USA, The National Academies Press. https://doi.org/10.17226/12628, 2011 490 New South Wales (NSW) Department of Planning, Hazardous industry planning advisory paper number 10 - Land use safety planning, New South Wales (NSW) Department of Planning, Australia, 2011 Owen, J.R., Kemp, D., Lèbre, É., Svobodova, K. and Pérez Murillo, G. Catastrophic tailings dam failures and disaster risk disclosure, International Journal of Disaster Risk Reduction, Volume 42, January 2020, 101361, 2020 Palú, M.C and Julien, P.Y. A review of tailings dam failures in Brazil, 24 to 28 November 2019, Conference: XXIII Simpósio 495 Brasileiro De Recursos Hídricosat: Foz do Iguaçú, Brazil, 2019 Petkovšek, G., Hasan, M.A.A.H., Lumbroso, D. and Roca Collell, M. A two-fluid simulation of tailings dam breaching, submitted, Mine Water and the Environment, Journal of the International Mine Water Association (IMWA), 2020 Petley, D. The speed of the Brumadinho tailings dam landslide, The landslide blog, 4 February 2019, available at: https://blogs.agu.org/landslideblog/2019/02/04/brumadinho-tailings-dam-landslide/ last access: 2 April 2020 500 Porsani, J.L., de Jesus, F.A.N and Stangar, M. C. iGPR Survey on an iron mining area after the collapse of the tailings dam I at the Córrego do Feijão Mine in Brumadinho-MG, Brazil, Remote Sensing 2019,11, 860; doi:10.3390/rs11070860, 2019

23

https://doi.org/10.5194/nhess-2020-159 Preprint. Discussion started: 4 June 2020 c Author(s) 2020. CC BY 4.0 License.

Raman, A. and Liu, F. An investigation of the Brumadinho dam break with HEC RAS simulation arXiv:1911.05219 [physics.comp-ph], 2019 Rickenmann, D. Empirical relationships for debris flows, Natural Hazards, Vol. 19, No. 1, pp. 47-77, 1999 505 Rickenmann, D., Laigle, D., McArdell, B. and Hübl, J. Comparison of 2D debris-flow simulation models with field events, Computational Geosciences 10: pp241–264, 2006 Robertson, P.K., de Melo, L., Williams, D.J. and Ward Wilson, G. Report of the expert panel on the technical causes of the failure of Feijão Dam I, 12 December, 2019 Sagan, S. The limits of safety: Organizations, accidents and nuclear weapons, Published by Princeton University Press, New 510 Jersey, USA, 1993 Sampaio, J.A.L. The deficiencies of the emergency action planning for dams in Brazil, Revista Brasileira de Direito, Passo, Fundo, Vol 12, No 2, pp7-17, December, 2016 Tagg, A., Di Mauro, M., Lumbroso, D., Vinet, F. and Stone, K. Development of a framework for improving flood emergency plans, and its use in dam risk reduction, Association of State Dam Safety Officials Annual Conference, 16-20 September 2012, 515 Denver, Colorado, USA, 2012 Terra Diário de Brumadinho: de vilarejo bucólico a comunidade esvaziada, 2020 available at: https://www.terra.com.br/noticias/brasil/cidades/diario-de-brumadinho-de-vilarejo-bucolico-a-comunidade- esvaziada,68e17fff4ca9e5a8ac8fe2c0a8570193awcv4smd.html last Access: 22 April 2020 United States Bureau of Reclamation (USBR) Guidelines for achieving public protection in dam safety decision making. Dam 520 Safety Office, Department of the Interior, Denver, Colorado, USA, 2003 United States Department of the Interior Bureau of Reclamation (USBR) RCEM – Reclamation Consequence Estimating Methodology – Interim – Guidelines for estimating life loss for dam safety risk analysis, February, 2014 United States Department of Homeland Security Dams sector: Estimating loss of life for dam failure scenarios, September, 2011 525 United States Army Corps of Engineers (USACE) Safety of dams policy and procedures, Report ER 1110-2-1156, 28 October, 2011 Vick, S. Planning, design, and analysis of tailings dams, Published by BiTech, Vancouver, Canada, ISBN: 978-0921095125, 1990 Xinhua 200 people missing after tailings dam collapse in Brazil, 2019 available at: http://www.xinhuanet.com/english/2019- 530 01/26/c_137775172.htm last access: 14 April 2020 YouTube Brumadinho dam collapse footage Brazil, 2019 available at: https://www.youtube.com/watch?v=Adk0AwcISHo last access: 9 April 2020

24